Alert remediation automation

ABSTRACT

Technical solutions to automate alert remediation are described. One aspect includes a method that includes receiving a plurality of alerts from an application monitoring system, the plurality of alerts associated with a plurality of remediation procedures respectively. The method also includes selecting a subset of alerts from the plurality of alerts. The method also includes identifying a subset of remediation procedures corresponding to the subset of alerts and analyzing compliance, with a service level agreement, of an execution of the entire subset of remediation procedures. In response to the execution of the entire subset of remediation procedures being non-compliant, the latest alert that was added, is removed from the subset of alerts, and a remediation procedure corresponding to the latest alert is removed from the subset of remediation procedures. The method includes executing the entire subset of remediation procedures.

DOMESTIC PRIORITY

This application is a continuation of and claims priority from U.S.patent application Ser. No. 14/930,758, filed on Nov. 3, 2015, entitled“ALERT REMEDIATION AUTOMATION,” the entire contents of which areincorporated herein by reference.

BACKGROUND

The present application relates to alert remediation, and morespecifically, to automate consolidation of alert remediation.

An application monitoring system generates alerts in response to events,such as errors, user requests for enhancements, or other such causesthat trigger an alert. An alert may be categorized according to ahierarchy, such as a Level-1 alert, a Level-2 alert, a Level-3 alert,and so on, depending on a hierarchy chosen by an organization thathandles and responds to the alert according to a remediation procedureassociated with the alert. Depending on the categorization, differentmembers of staff at the organization may handle the alert. Automatingthe remediation of the alert helps increase productivity of the staffhandling the remediation procedures of the alert.

SUMMARY

According to an embodiment, a method for automated alert remediationincludes receiving a plurality of alerts from an application monitoringsystem, the plurality of alerts associated with a plurality ofremediation procedures respectively. The method also includes selectinga subset of alerts from the plurality of alerts. The method alsoincludes identifying a subset of remediation procedures corresponding tothe subset of alerts. The method also includes analyzing compliance,with a service level agreement, of an execution of the entire subset ofremediation procedures. The method also includes, in response to theexecution of the entire subset of remediation procedures beingnon-compliant, removing the latest added alert from the subset ofalerts, removing, from the subset of remediation procedures, aremediation procedure corresponding to the first alert, and executingthe entire subset of remediation procedures.

According to an embodiment, a system for automated remediation of alertsincludes a communication interface to access a plurality of alertsgenerated by an application monitoring system. The system also includesa processor for execution of one or more remediation procedures inresponse to the plurality of alerts. The processor selects a subset ofalerts from the plurality of alerts. The processor selects a subset ofremediation procedures corresponding to the subset of alerts. Theprocessor determines compliance, with a service level agreement, of anexecution of the entire subset of remediation procedures. The processor,in response to the execution of the entire subset of remediationprocedures being non-compliant, removes the latest added alert from thesubset of alerts, removes, from the subset of remediation procedures, aremediation procedure corresponding to the first alert, and executes theentire subset of remediation procedures.

According to an embodiment, a computer program product for automatedalert remediation includes computer readable storage medium. Thecomputer readable storage medium includes computer executableinstructions. The computer readable storage medium includes instructionsto select a subset of alerts from a plurality of alerts generated by anapplication monitoring system. The computer readable storage mediumincludes instructions to select a subset of remediation procedurescorresponding to the subset of alerts. The computer readable storagemedium includes instructions to determine compliance, with a servicelevel agreement, of an execution of the entire subset of remediationprocedures. The computer readable storage medium includes instructionsto, in response to the execution of the entire subset of remediationprocedures being non-compliant, remove the latest alert from the subsetof alerts; remove, from the subset of remediation procedures, aremediation procedure corresponding to the latest alert; and execute theentire subset of remediation procedures.

BRIEF DESCRIPTION OF THE DRAWINGS

The examples described throughout the present document may be betterunderstood with reference to the following drawings and description. Thecomponents in the figures are not necessarily to scale. Moreover, in thefigures, like-referenced numerals designate corresponding partsthroughout the different views.

FIG. 1 illustrates an example automated alert remediation system inaccordance with an embodiment.

FIG. 2 illustrates a flowchart of automated alert remediation inaccordance with an embodiment.

FIG. 3 illustrates a flowchart of automated alert remediation inaccordance with another embodiment.

DETAILED DESCRIPTION

Disclosed here are technical solutions for automating remediation ofalerts generated by an application monitoring system (AMS). The AMSmonitors execution of one or more applications by a computer system, andgenerates alerts in response to occurrence of a predetermined conditionduring execution of the one or more applications. For example, the AMSgenerates an alert in response to occurrence of an error duringexecution of an application, such as an invalid memory access, a networkerror, response time being below a predetermined threshold, or any othererrors. The AMS also monitors conditions of the computer system itselfduring the execution of the one or more applications and generates analert on occurrence of conditions such as, a processor temperatureincreasing beyond a predetermined threshold, available storage leveldecreasing below a predetermined threshold, and other such conditionsand a combination thereof.

Empirical data suggests that the among the alerts that an AMS generates,about 80% are categorized as those that are remediated according tostandard remediation procedures, and the rest 20% are remediated bymajor enhancements or development work. Accordingly, automating theremediation of the majority of the alerts that are remediated usingstandard procedures can facilitate the organization to increaseproductivity of the staff handling the alerts by focusing on thedevelopment work.

The AMS generates alerts in a continuous manner. The alerts havedifferent severity levels (Level-1, level-2 and so on). In addition,different alerts may be associated with distinct service levelagreements (SLAs). Accordingly, remediation procedures for differentalerts include multiple steps and execution conditions which lead todependencies and conflicts among execution of remediation procedures ofthe alerts. Thus, a technical problem with automation of remediationprocedures of multiple alerts that are the AMS continuously generates isto ensure compliance of execution of the remediation procedures of thealerts.

Accordingly, the technical solutions described herein navigate thecompliance requirements, based on the SLAs, for the remediationprocedures and consolidate execution of multiple remediation procedures,thus facilitating consolidation of execution of remediation proceduresfor multiple alerts to increase productivity of an organization.

Typically, organizations use an Alert-RP mapping to remediate an alert(RP=remediation procedures). The remediation procedure for an alert mayinclude a series of actions specified by a standard operating procedure(SOP) for the particular alert, or type of alert. In organizations thatrely on the Alert-RP mapping, an automated remediation system, uponreceiving an alert, identifies the SOP corresponding to the alert basedon the mapping, and executes the series of steps in the identified SOP.The automated remediation system in such cases, repeats this processupon receipt of a next alert. Such an automated remediation system isrigid, as the next alert cannot be processed until the previous alerthas been processed. Further, the automated remediation system in thiscase ignores correlation of alerts, and further ignores overlap,dependency, and conflict among the SOPs for the alerts generated.

The technical solutions described herein overcome such inefficiencies,and improve efficiency and effectiveness of an automated remediationsystem by identifying relations between one or more alerts andconsolidating the corresponding remediation procedures. Thus, thetechnical solutions do not process the generated alerts sequentially,one by one. The technical solutions, instead, use a variable lengthsliding time window (VLSTW) to maximize the remediation efficiency byprocessing a batch of alerts and minimize the remediationineffectiveness by verifying cross-SOP compliance. Further yet, thetechnical solutions ensure compliance with constraints specified inSLAs.

FIG. 1 illustrates an example automated remediation system 100. Theautomated remediation system 100 includes, among other components,hardware such as a processor 110, a memory 120, a communicationinterface 130, and system circuitry 140.

The processor 110 may be a central processor of the automatedremediation system responsible for execution of an operating system,control instructions, and applications installed on the automatedremediation system 100. The processor 110 may be one or more devicesoperable to execute logic. The logic may include computer executableinstructions or computer code embodied in the memory 120 or in othermemory that when executed by the processor 110, cause the processor 110to perform the features implemented by the logic. The computer code mayinclude instructions executable with the processor 110. The computercode may include embedded logic. The computer code may be written in anycomputer language now known or later discovered, such as C++, C#, Java,Pascal, Visual Basic, Perl, HyperText Markup Language (HTML),JavaScript, assembly language, shell script, or any combination thereof.The computer code may include source code and/or compiled code. Theprocessor 110 may be a general processor, central processing unit,server, application specific integrated circuit (ASIC), digital signalprocessor, field programmable gate array (FPGA), digital circuit, analogcircuit, or combinations thereof. The processor 110 may be incommunication with the memory 120, the communication interface 130, thesystem circuitry 140, and other components of the automated remediationsystem 100.

The memory 120 is non-transitory computer storage medium. The memory 120may be DRAM, SRAM, Flash, or any other type of memory or a combinationthereof. The memory 120 stores control instructions and applicationsexecutable by the processor 110. The memory 120 may contain other datasuch as images, videos, documents, spreadsheets, audio files, and otherdata that may be associated with operation of the system 100.

The communication interface 130 facilitates the automated remediationsystem 100 to receive and transmit data. For example, the communicationinterface 130 receives alerts 150 from the AMS, such as in the form of acomputer network communication. The computer network communication maybe wired or wireless. Alternatively or in addition, the communicationinterface 130 facilitates communication in other manners, such as viacommunication ports like Universal Serial Bus™ (USB), Ethernet,Thunderbolt™, or any other communication ports. The communicationinterface 130 further facilitates the automated remediation system 100to transmit data, such as to execute the remediation procedures inresponse to the alerts. For example, the communication interface 130facilitates communication with a display, audio system, and any otherinput/output peripheral. The alerts 150, in another example may beaccessed by the communication interface 130, from a data repository,such as a remote computer or database system. For example, the AMS, upongeneration of the alerts 150, stores the alerts 150 in the datarepository and sends a communication to the automated remediation system100 indicative of the availability of the alerts 150. In response, theautomated remediation system 100, via the communication interface 130,accesses the alerts 150. The automated remediation system 100 receivesand/or accesses the alerts 150 in an order in which they were generated.That is, the automated remediation system 100 accesses a first alertgenerated at t1 followed by a second alert generated at t2 followed by athird alert generated at t3 and so on, where t1, temporally occursbefore t2, which in turn occurs before t3.

The system circuitry 140 includes hardware components that the processor110 uses to execute the remediation procedures in response to thealerts. For example, the system circuitry 140 may include input/outputperipherals such as keyboard and mouse. Alternatively or in addition,the system circuitry 140 includes human interaction components such asdisplay and audio input/output circuitry. Alternatively or in addition,the system circuitry 140 includes computational devices such as graphicsprocessing unit (GPU), arithmetic unit (AU),or any other co-processor.

FIG. 2 illustrates a flowchart of an overall operation of theremediation automation system 100. The remediation automation system 100analyzes a subset of alerts from the set of alerts 150. A variablelength sliding time window 210 selects the subset of alerts analyzed.The processor 110 analyzes the selected subset of alerts to identify asubset of remediation procedures, as shown at block 220. The subset ofremediation procedures includes SOPs corresponding to the selectedalerts. The analysis further includes determining a correlation amongthe alerts in the selected subset. For example, the processor 110identifies common characteristics of the alerts. For example, thecharacteristics of an alert may include an application for which thealert is generated, a type of the issue for which the alert is generated(such as processor related, storage related, user-interface related, orspeed-related), a category of the alert (such as level-1, level-2).Alternatively or in addition, the processor 110 identifies relationamong the alerts in the selected subset based on historical data. Forexample, the processor 110 groups two or more alerts that occur within ashort time period. In another example, the processor 110 groups a pairof alerts in case a first alert occurs only after a second alert. In yetanother example, the processor 110 groups one alert that is remediatedafter another alert has been remediated.

The processor further analyzes compliance of the remediation proceduresin the subset of remediation procedures corresponding to the selectedsubset of alerts, as shown at block 230. For example, the processor 110analyzes the characteristics and/or attributes of the remediationprocedures in the subset, such as an estimated time to execute theremediation procedures. The processor 110, in addition, may determine anoverlap in the actions included in the remediation procedures in thesubset. For example, a first remediation procedure includes actions A,B, C, and D in response to the corresponding alert. In case a secondremediation procedure includes actions E, B, and F, the processor 110identifies that the first and second remediation procedures has a commonaction B, which may be consolidated. Accordingly, the processor 110 mayreduce the time of execution by executing the first and secondremediation procedures in conjunction, and thus improve the efficiencyof the automated remediation. Further yet, the processor 110 maydetermine dependencies between the remediation procedures in the subset.For example, in the above first and second remediation procedures, ifthe action F depends on action B, the processor 110 determines the orderof execution of the actions for the first and second remediationprocedures such that F occurs after B.

The processor 120 further determines if any of the remediationprocedures in the subset conflict with each other. For example, in theabove example, if action D of the first remediation procedure is to shutdown an application, and the action F is to input a particular valueinto the application, the first and second remediation proceduresconflict with each other. Accordingly, the processor 110 may determinethat the first and second remediation procedures are not compliant witheach other, or in other words that the subset of remediation proceduresis non-compliant. In case the remediation procedures are compliant theprocessor 110 merges the remediation procedures in the subset byconsolidating the overlapping actions.

Alternatively or in addition, the processor 110 may determine acompliance of the subset of remediation procedures with respect to anSLA. For example, the processor 110 may estimate an execution time forthe subset of remediation procedures. The processor 110 compares theestimated execution time with one or more constraints specified in anSLA, to ensure that the SLA constraints are being met.

The processor 110 adds an alert from the alerts 110 to the subset ofalerts being analyzed by adjusting a length of the variable lengthsliding window 210 in case the current subset of alerts is not optimal,as shown at block 240 and 245. For example, if the estimated executiontime of the current subset of remediation procedures is below thespecified constraint in the SLA, the processor 110 concludes thatadditional alerts could be remedied. For example, consider that thecurrent subset of alerts includes alert-1 and alert-2, and thecorresponding subset of remediation procedures including RP-1 and RP-2executes in 5 seconds. If the SLA constrains the remediation executiontime to 10 seconds, the processor 110 attempts to increase the number ofalerts that will be remedied in the variable length sliding time window210, by analyzing a subset of alerts including an alert-3 in addition tothe alerts alert-1 and alert-2. The processor 110, in this way, attemptsto optimize the goal, by meeting the constraint in the SLA as closely aspossible, as shown at block 240.

Alternatively, if the current subset of alerts is optimal, the processor110 executes the entire subset of remediation procedures correspondingto the current subset of alerts, as shown at block 240 and 250. Theprocessor 110, during execution of the remediation procedures,consolidates the overlapping actions to improve efficiency of theautomated remediation. At the conclusion of the execution of the entiresubset of remediation procedures, the processor slides the variablelength sliding time window 210 to the subsequent alert from the alerts150, as shown at block 255. The variable length sliding time window 210has a default length, and for example may include the next 10, 5, 1, orany other number of alerts from the alerts 150. The processor 110repeats the process described herein to execute the remediationprocedures corresponding to the rest of the alerts.

FIG. 3 illustrates a flowchart for automating an alert remediationsystem, such as the system 100. The processor 110 initializes a variablelength sliding time window (VLSTW). The VLSTW selects a subset of apredetermined number of alerts from the multiple alerts that the AMSgenerates, as shown at block 305. For example, the VLSTW selects threealerts, or five alerts, or 20 alerts, or any predetermined number ofalerts. In an example, the predetermined number is greater than or equalto two. The alerts that the VLSTW selects are processed in a batch. TheVLSTW selects the alerts in order in which they were created. Theprocessor 110 compares the compatibility of the alerts in the subset ofalerts, as shown at block 307. For example, the processor 110 comparescharacteristics of the alerts to determine compatibility of the alertsin the subset. If the alerts are not compatible, the processor updates alength of the VLSTW, by reducing the length by one. By updating thelength of the VLSTW, the processor 110 updates the subset of alerts byremoving the latest alert that was included in the subset of alerts, asshown at blocks 310 and 312.

The processor 110 identifies a subset of remediation procedures, or SOPsmapped to each of the alerts in the selected subset of alerts, as shownat block 315. The processor 110 identifies the SOPs based on a mappingbetween the alerts and the SOPs. The processor determines if the SOPs inthe subset of SOPs comply with constraints in an SLA. For example, theSLA may impose a constraint regarding an execution time for a batch ofremediation procedures, as shown at block 318. The processor 110compares the steps included in the respective SOPs in the subset of SOPsto identify overlap, and redundancy among the SOPs. The processor 110estimates an execution time to execute the entire subset of SOPs. Theprocessor 110 determines if the execution time complies with theconstraint in the SLA, as shown at block 320. If the execution time isclose to the SLA constraint by a predetermined threshold, the processor110 executes the entire subset of SOPs, as shown at block 325. Forexample, the processor 110 determines if Σ_(i=1)^(VSLTW length)ExecutionTime_(i)<SLA_(ResponseTime).

For example, the processor 110 may determine a difference between theestimated execution time and the SLA constraint and compare thedifference with a predetermined threshold. Of course, in case theestimated execution time is more than the SLA constraint, the processor110 removes the latest alert from the subset of alerts, as shown atblock 312. For example, if the SLA constraint is 2 seconds, in responseto the execution of the entire subset of remediation proceduresestimated to take 3 seconds, the processor 110 removes the latest alertthat was added to the subset of alerts. Correspondingly, the processor110 removes, from the subset of remediation procedures, a remediationprocedure of the alert that was removed. The estimated execution time ofthe subset of remediation procedures thus reduces, and if it is nowcompliant with the predetermined threshold, the processor 110 executesthe entire subset of remediation procedures. Alternatively, if theestimated execution time of the entire subset of SOPs is less than theSLA constraint by more than the predetermined threshold, the processor110 may add a next alert to the subset of alerts and thus increase thelength of the VLSTW, as shown at block 322. The processor 110, at thistime, continues to update the subset of SOPs by adding a SOPcorresponding to the next alert and determining the compliance of theupdated subset of SOPs. The processor 110 continues this process untilall the alerts that the AMS generated have been responded to, as shownat block 330. If there are more alerts that have not been responded to,the processor slides the VLSTW to select the next subset of alerts. Thenext subset includes the predetermined number of alerts starting fromthe latest alert that was responded to in the previous iteration.

Thus, the automated remediation system 100 maximizes the size ofsequential alerts in a batch for remediation. The VLSTW starts from afirst alert to process, and is enlarged to contain as many sequentialalerts as can be executed within the SLA constraint. The systemadditionally performs correlation analysis and SOPs compliance analysisfor the selected alerts. If the alerts and SOPs are compliant, thesystem marks (or replaces) the SOPs to generate a consolidated subset ofSOPs as a candidate for execution, and attempts enlarge the VLSTW byrepeating the above process. When compliance is broken, that is theexecution time is more than the SLA constraint, the system executes theentire latest candidate subset of SOPs without the latest alert that wasbeing processed.

The present invention may be a system, a method, and/or a computerprogram product at any possible technical detail level of integration.The computer program product may include a computer readable storagemedium (or media) having computer readable program instructions thereonfor causing a processor to carry out aspects of the present invention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, configuration data for integrated circuitry, oreither source code or object code written in any combination of one ormore programming languages, including an object oriented programminglanguage such as Smalltalk, C++, or the like, and procedural programminglanguages, such as the “C” programming language or similar programminglanguages. The computer readable program instructions may executeentirely on the user's computer, partly on the user's computer, as astand-alone software package, partly on the user's computer and partlyon a remote computer or entirely on the remote computer or server. Inthe latter scenario, the remote computer may be connected to the user'scomputer through any type of network, including a local area network(LAN) or a wide area network (WAN), or the connection may be made to anexternal computer (for example, through the Internet using an InternetService Provider). In some embodiments, electronic circuitry including,for example, programmable logic circuitry, field-programmable gatearrays (FPGA), or programmable logic arrays (PLA) may execute thecomputer readable program instructions by utilizing state information ofthe computer readable program instructions to personalize the electroniccircuitry, in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the blocks may occur out of theorder noted in the Figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

The descriptions of the various embodiments of the present inventionhave been presented for purposes of illustration, but are not intendedto be exhaustive or limited to the embodiments disclosed. Manymodifications and variations will be apparent to those of ordinary skillin the art without departing from the scope and spirit of the describedembodiments. The terminology used herein was chosen to best explain theprinciples of the embodiments, the practical application, or technicalimprovement over technologies found in the marketplace, or to enableothers of ordinary skill in the art to understand the embodimentsdisclosed herein.

What is claimed is:
 1. A computer-implemented method automated alertremediation, the method comprising: receiving, by a processor, aplurality of alerts from an application monitoring system, the pluralityof alerts associated with a plurality of remediation proceduresrespectively; selecting a subset of alerts from the plurality of alerts;identifying a subset of remediation procedures corresponding to thesubset of alerts; analyzing compliance, with a service level agreement,of an execution of the entire subset of remediation procedures; and inresponse to the execution of the entire subset of remediation proceduresbeing non-compliant: removing the an alert from the subset of alerts;removing, from the subset of remediation procedures, a remediationprocedure corresponding to the removed alert; and executing the entiresubset of remediation procedures.
 2. The computer-implemented method ofclaim 1, wherein executing the entire subset of remediation procedurescomprises merging one or more remediation procedures in the subset. 3.The computer-implemented method of claim 1, wherein executing the entiresubset of remediation procedures comprises identifying overlappingportions in the remediation procedures in the subset.
 4. Thecomputer-implemented method of claim 1, wherein executing the entiresubset of remediation procedures comprises determining a sequence forexecuting the remediation procedures in the subset according todependencies among the remediation procedures in the subset.
 5. Thecomputer-implemented method of claim 1, wherein the alert that isremoved from the subset of alerts is the alert that is temporally themost recent from among the alerts in the subset of alerts.
 6. Thecomputer-implemented method of claim 1, further comprising, in responseto the execution of the entire subset of remediation procedures beingcompliant with the service level agreement: update the subset of alertsby adding a next alert from the plurality of alerts to the subset ofalerts and adding, to the subset of remediation procedures, aremediation procedure corresponding to the next alert; and repeating theanalysis and update of the subset of alerts and the corresponding subsetof remediation procedures until the execution of the entire subset ofremediation procedures is determined as being non-compliant with theservice level agreement.
 7. The computer-implemented method of claim 6,wherein the next alert that is added to the subset of alerts istemporally the earliest from among the plurality of alerts.
 8. Thecomputer-implemented method of claim 1, wherein analyzing compliance ofthe subset of remediation procedures comprises determining that apredicted time to execute the entire subset of remediation procedures isless than a predetermined constraint specified in the service levelagreement.
 9. The computer-implemented method of claim 1, whereinanalyzing compliance of the subset of remediation procedures comprisesdetermining a conflict in the remediation procedures among the subset ofremediation procedures, and wherein the execution of the entire subsetis compliant in response to an absence of the conflict.